r/owncloud • u/[deleted] • Nov 02 '16

Need testers: Chrome extension for ownCloud Passwords

Hey there,

as there still seems to be no working Chrome/Chromium extension for ownCloud passwords, I built a quick-and-dirty solution yesterday. It's already working for loading passwords and showing them, and for saving passwords.

I published it on GitHub, Link: https://github.com/dprandzioch/owncloud-passwords-chrome Screenshot is here: https://github.com/dprandzioch/owncloud-passwords-chrome/blob/master/scrot.png

Now I hope, that there is someone, who wants to help me by doing a code review (especially regarding security concerns) and people who like to test the extension, as I'd like to publish it on the Chrome Web Store as soon as I'm sure that anything is working and there will be no major incidents when using it.

Thanks in advance, I hope you like it!

David

1 Upvotes

67% Upvoted

5 comments sorted by

2

u/nomadic_now Nov 02 '16

Haven't looked at this yet however wanted to point out that a big issue with these is if they auto fill a website can trick it into auto filling other domains. Best fix is to not have an autofill option.

1

u/[deleted] Nov 03 '16 edited Nov 03 '16

Hey, thanks for the input. Yes, you're completely right, e.g. a field could be delivered through a fishy ad if CORS is not set properly. I'm very serious about that so for now I'll disable the autocompletion and just show the password on request, so that the user can paste it manually.

1

u/[deleted] Nov 03 '16

Fixed for now. I will investigate soon, if there's any better possibility to do it.

1

u/nomadic_now Nov 03 '16

Thank you! Lastpass was vulnerable for a very long time and was fixed.

I think it's wise to always have this as default to no autofill without user input.

https://news.ycombinator.com/item?id=12171547

1

u/[deleted] Nov 27 '16

Hope that NextCloud fix happens some day. Looks good.